Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys

What it is

Eight eMudhra intermediate CA certificates issued in April 2025 have been blocked by browser and OS trust stores because their private keys can be recovered from the certificates. The page adds the response details: who else acted, how to check a client, and what is still unknown.

Preconditions / Affected

Google says anyone can forge trusted HTTPS certificates for any website against clients that have not yet removed trust in these CAs. Blocking and revocation are done, but the page says some clients may need a software update before the intermediates are no longer trusted.

What to do

• Check whether your clients still trust the eight intermediates. Mozilla's Dennis Jackson has published a tool for this. The page does not give its name or URL, so find it through Jackson's or Mozilla's announcement.
• Apply browser and OS updates. Mozilla and Google blocked the certificates on October 17, Apple on October 19 and Microsoft on October 20. Cloudflare patched its services, and Sectigo took revocation steps.
• Check non-browser clients and embedded software separately. The page says only that some clients may need updates, and does not list which.

Caveats

• The page reports no evidence in Certificate Transparency logs of malicious use before revocation. Not all clients enforce CT, so forged certificates aimed at those clients would not show up there.
• Jackson warned that several individuals have independently recovered the keys, and that the process is fairly easy and fast.
• eMudhra says the issuers were meant for export to its US and European data centers for data sovereignty reasons, and that only one reached production.
• eMudhra says it will re-verify every key ceremony it has done over the following week. It admits human errors at multiple steps and is still looking for code flaws, process gaps and maker/checker control gaps. No findings are reported yet.
• The page does not say which eight certificates are affected or list their fingerprints.